Hunt Tls Network
Hunt TLS/SSL and DNS misconfigurations, missing HSTS (downgrade attack), weak cipher...
Install
npx skills add Zyrexnn/Cybermes --skill hunt-tls-network -g -a claude-code -y- Repository
- Zyrexnn/Cybermes987
- Category
- DevOps
- Updated
- 3d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Hunt TLS/SSL and DNS misconfigurations, missing HSTS (downgrade attack), weak cipher suites, expired/invalid certificates, mTLS bypass, missing SPF/DKIM/DMARC (email spoofing), DNS Zone Transfer (AXFR), dangling CNAME subdomain takeover, CAA records. Most of these are Info/Low on their own, this skill is opinionated about which findings actually pay (spoofable DMARC with delivered-to-inbox proof, AXFR returning internal hosts, dangling-CNAME takeover) versus which get rejected as best-practice noise (missing CAA, missing HSTS with no MitM position). Use during recon to find infrastructure weaknesses, and to TRIAGE them honestly before reporting.
HUNT-TLS-NETWORK, TLS/SSL & DNS Security
Reality Check (Read First)
Most findings in this class are Info/Low and routinely rejected as "best-practice" / "missing-hardening" by triage. This skill exists to stop you wasting a submission. Two questions before you report anything here:
- Is there a real victim and a real action? "Missing HSTS" is not a vulnerability, demonstrated session-cookie capture from a victim you MitM'd is. "Missing CAA" is never a vulnerability you can demonstrate.
- Does the program accept it? Many programs explicitly list missing SPF/DMARC, missing security headers, weak ciphers without exploit, and CAA as out of scope. Read scope first; quote the in-scope line in your report.
What actually pays in this class (in order):
- Dangling-CNAME / dangling-A subdomain takeover, you control content on
target.comsubdomain. Real impact, real bounty. (Owned in depth byhunt-subdomain; covered here for the TLS/DNS recon angle.) - Spoofable DMARC, proven by delivered-to-inbox email, not "p=none exists" but an actual mail from
ceo@target.comlanding in a real inbox with a passing/none DMARC verdict in the headers. - DNS AXFR returning internal hosts, full internal hostname/IP map. Concrete recon value, often Medium.
- mTLS / client-cert bypass on an internal service, reaching authenticated-only functionality without the cert. Real auth bypass = High.
- Exploited TLS weakness with a working decrypt/MitM PoC, almost never achievable remotely in 2024-2026 against a patched stack; see Phase 1 caveats.
What does NOT pay (do not report standalone): missing CAA, missing HSTS with no MitM PoC, missing security headers alone, weak-cipher support without an exploit, self-signed cert on a non-prod host, TLS 1.0/1.1 enabled without a downgrade victim.
